Nippon Columbia Data Breach Exposes 8.7 Million Customer Records

Key Takeaways

• A malware infection at Nippon Columbia Group has potentially exposed 8.7 million customer and employee records belonging to Daiichi Kosho.
• The breach originated from an infected computer belonging to a contractor’s employee.
• While data theft is unconfirmed, the exposed information may include names, gender, dates of birth, email addresses, and phone numbers.
• Daiichi Kosho’s internal systems remain unaffected, highlighting third-party vendor risk.
• Customers are advised to exercise caution regarding unsolicited communications.

The Nippon Columbia Group recently disclosed a malware infection that occurred on October 8, 2026, which may have led to the exposure of millions of records belonging to customers and employees of Daiichi Kosho. The incident originated when a computer utilized by a contractor’s employee became compromised by malware.

Daiichi Kosho has stated that, as of now, there is no confirmation of data theft or misuse, and its internal systems have not been impacted. The total number of records potentially at risk is estimated at 8.724 million. This figure encompasses approximately 8.631 million customer records and an additional 93,000 employee records.

It is important to note that these figures represent the total number of records that were potentially compromised, rather than a confirmed count of individuals whose information has been stolen. The total includes both customer and employee data, even though public headlines often focus solely on the 8.7 million customer records.

Nippon Columbia Group is responsible for handling personal information on behalf of Daiichi Kosho. According to the company’s initial incident notice, personal data related to this work was temporarily stored on the infected computer. Investigators have been unable to definitively rule out the possibility that this information may have been exfiltrated from the organization’s network.

Reports indicate that Nippon Columbia informed Daiichi Kosho of the breach on October 5, subsequently isolating the compromised computer the following day. The contractor also took steps to reset passwords and other login credentials as part of its ongoing investigation into the incident’s root cause, its full scope, and any potential online release of the affected data.

Nippon Columbia Malware Infection Exposed

Current public disclosures do not specify the type of malware involved, identify the threat actor, or explain the initial vector of infection. Furthermore, there is no technical evidence provided to confirm that files were indeed copied or transferred outside the network. Consequently, this incident cannot be definitively classified as a confirmed ransomware attack or a proven data theft operation at this stage.

The information potentially exposed includes registered names, gender, dates of birth, email addresses, and telephone numbers. Customers of various services, including BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining, could be affected. The compromised records are linked to individuals who registered as members or made reservations through these company services.

Daiichi Kosho has confirmed that passwords were not included in the potentially exposed information. Additionally, the company has reported no evidence of unauthorized use of loyalty points associated with customer accounts.

This incident underscores the inherent risks associated with outsourcing data handling to third-party providers. It demonstrates that a client’s data can be exposed even if their own internal systems remain secure, emphasizing the critical importance of robust vendor security protocols.

Daiichi Kosho issued an update on October 9, announcing the establishment of a dedicated toll-free inquiry hotline at 0120-732-079. This service operates from 10:00 a.m. to 5:00 p.m. daily, excluding Saturdays, Sundays, and public holidays. For those unable to reach the company by phone, inquiries can also be directed to [email protected].

The company has reiterated its apologies for the concern and inconvenience this incident has caused. While no unauthorized use of personal information has been confirmed yet, the investigation is ongoing. Daiichi Kosho has pledged to continue collaborating with relevant authorities to determine the exact cause and implement measures to prevent future occurrences.

What You Should Do

• Be Vigilant for Phishing: Exercise extreme caution with any unexpected emails, text messages, or phone calls, especially those requesting personal information, financial details, or payments.
• Monitor Accounts: Regularly review your bank statements and other financial accounts for any suspicious activity.
• Strengthen Passwords: While passwords were not reportedly exposed in this incident, it is always a good practice to use strong, unique passwords for all online accounts and enable multi-factor authentication (MFA) wherever possible.
• Stay Informed: Keep an eye on official communications from Daiichi Kosho for any further updates or recommendations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.